@google/adk 1.3.0 → 1.5.0

package/dist/cjs/agents/processors/interactions_request_processor.js

@@ -0,0 +1,63 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var interactions_request_processor_exports = {};
+__export(interactions_request_processor_exports, {
+  INTERACTIONS_REQUEST_PROCESSOR: () => INTERACTIONS_REQUEST_PROCESSOR,
+  InteractionsRequestProcessor: () => InteractionsRequestProcessor
+});
+module.exports = __toCommonJS(interactions_request_processor_exports);
+var import_google_llm = require("../../models/google_llm.js");
+var import_llm_agent = require("../llm_agent.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class InteractionsRequestProcessor {
+  // eslint-disable-next-line require-yield
+  async *runAsync(invocationContext, llmRequest) {
+    const agent = invocationContext.agent;
+    if (!agent || !(0, import_llm_agent.isLlmAgent)(agent)) {
+      return;
+    }
+    const model = agent.canonicalModel;
+    if ((0, import_google_llm.isGemini)(model) && model.useInteractionsApi) {
+      const events = invocationContext.session.events;
+      for (let i = events.length - 1; i >= 0; i--) {
+        const event = events[i];
+        if (event.branch === invocationContext.branch && event.author === agent.name && event.interactionId) {
+          llmRequest.previousInteractionId = event.interactionId;
+          break;
+        }
+      }
+    }
+  }
+}
+const INTERACTIONS_REQUEST_PROCESSOR = new InteractionsRequestProcessor();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  INTERACTIONS_REQUEST_PROCESSOR,
+  InteractionsRequestProcessor
+});

package/dist/cjs/agents/routed_agent.js

@@ -64,6 +64,29 @@ let RoutedAgent = class extends (_b = import_base_agent.BaseAgent, _a = ROUTED_A
     }
     this.router = config.router;
   }
+  /**
+   * Creates a detached copy of this routed agent.
+   *
+   * The inherited {@link BaseAgent.clone} only deep-clones `subAgents`, but a
+   * `RoutedAgent` derives its routing targets from `config.agents`. Rebuilding
+   * through the base clone alone would re-read the already-parented original
+   * agents and throw "already has a parent agent". This override deep-clones the
+   * routing targets (unless the caller overrides `agents`) so the rebuilt
+   * constructor re-parents fresh, detached copies. The array-vs-record shape
+   * and, for records, the keys are preserved so the router keeps selecting the
+   * same targets.
+   *
+   * @param overrides Config fields to override on the clone. Overriding
+   *     `parentAgent` is rejected by the base implementation.
+   * @returns A new detached `RoutedAgent` of the same concrete class.
+   */
+  clone(overrides) {
+    const nextOverrides = { ...overrides };
+    if (!("agents" in nextOverrides)) {
+      nextOverrides.agents = cloneRoutingTargets(this.config.agents);
+    }
+    return super.clone(nextOverrides);
+  }
   /**
    * Runs the selected agent via text-based conversation.
    */
@@ -90,6 +113,14 @@ let RoutedAgent = class extends (_b = import_base_agent.BaseAgent, _a = ROUTED_A
 RoutedAgent = __decorateClass([
   import_experimental.experimental
 ], RoutedAgent);
+function cloneRoutingTargets(agents) {
+  if (Array.isArray(agents)) {
+    return agents.map((agent) => agent.clone());
+  }
+  return Object.fromEntries(
+    Object.entries(agents).map(([key, agent]) => [key, agent.clone()])
+  );
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   RoutedAgent,

package/dist/cjs/agents/run_config.js

@@ -41,14 +41,15 @@ var StreamingMode = /* @__PURE__ */ ((StreamingMode2) => {
   return StreamingMode2;
 })(StreamingMode || {});
 function createRunConfig(params = {}) {
+  var _a;
   return {
     saveInputBlobsAsArtifacts: false,
     supportCfc: false,
     enableAffectiveDialog: false,
     streamingMode: "none" /* NONE */,
-    maxLlmCalls: validateMaxLlmCalls(params.maxLlmCalls || 500),
     pauseOnToolCalls: false,
-    ...params
+    ...params,
+    maxLlmCalls: validateMaxLlmCalls((_a = params.maxLlmCalls) != null ? _a : 500)
   };
 }
 function validateMaxLlmCalls(value) {

package/dist/cjs/apps/app.js

@@ -0,0 +1,79 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var app_exports = {};
+__export(app_exports, {
+  App: () => App,
+  isApp: () => isApp,
+  validateAppName: () => validateAppName
+});
+module.exports = __toCommonJS(app_exports);
+var import_base_agent = require("../agents/base_agent.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var _a;
+const VALID_APP_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+function validateAppName(name) {
+  if (!VALID_APP_NAME_RE.test(name)) {
+    throw new Error(
+      `Invalid app name '${name}': must start with a letter and can only consist of letters, digits, underscores, and hyphens.`
+    );
+  }
+  if (name === "user") {
+    throw new Error("App name cannot be 'user'; reserved for end-user input.");
+  }
+}
+const APP_SIGNATURE_SYMBOL = Symbol.for("google.adk.app");
+function isApp(obj) {
+  return typeof obj === "object" && obj !== null && APP_SIGNATURE_SYMBOL in obj && obj[APP_SIGNATURE_SYMBOL] === true;
+}
+_a = APP_SIGNATURE_SYMBOL;
+class App {
+  constructor(options) {
+    this[_a] = true;
+    var _a2, _b, _c, _d;
+    validateAppName(options.name);
+    if (options.rootAgent === void 0 || options.rootAgent === null) {
+      throw new Error("rootAgent must be provided.");
+    }
+    if (!(0, import_base_agent.isBaseAgent)(options.rootAgent)) {
+      throw new TypeError(
+        `rootAgent must be a BaseAgent instance, got ${(_c = (_b = (_a2 = options.rootAgent) == null ? void 0 : _a2.constructor) == null ? void 0 : _b.name) != null ? _c : typeof options.rootAgent}`
+      );
+    }
+    this.name = options.name;
+    this.rootAgent = options.rootAgent;
+    this.plugins = (_d = options.plugins) != null ? _d : [];
+    this.resumabilityConfig = options.resumabilityConfig;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  App,
+  isApp,
+  validateAppName
+});

package/dist/cjs/apps/resumability_config.js

@@ -0,0 +1,44 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resumability_config_exports = {};
+__export(resumability_config_exports, {
+  createResumabilityConfig: () => createResumabilityConfig
+});
+module.exports = __toCommonJS(resumability_config_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function createResumabilityConfig(params = {}) {
+  return {
+    isResumable: false,
+    ...params
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createResumabilityConfig
+});

package/dist/cjs/artifacts/file_artifact_service.js

@@ -67,7 +67,7 @@ class FileArtifactService {
     artifact,
     customMetadata
   }) {
-    if (!artifact.inlineData && !artifact.text) {
+    if (!artifact.inlineData && !artifact.text && !artifact.fileData) {
       throw new Error("Artifact must have either inlineData or text content.");
     }
     const artifactDir = getArtifactDir(
@@ -85,12 +85,19 @@ class FileArtifactService {
     const storedFilename = path.basename(artifactDir);
     const contentPath = path.join(versionDir, storedFilename);
     let mimeType;
+    let fileUri;
     if (artifact.inlineData) {
       const data = artifact.inlineData.data || "";
       await fs.writeFile(contentPath, Buffer.from(data, "base64"));
       mimeType = artifact.inlineData.mimeType || "application/octet-stream";
     } else if (artifact.text !== void 0) {
       await fs.writeFile(contentPath, artifact.text, "utf-8");
+    } else {
+      fileUri = artifact.fileData.fileUri;
+      if (!fileUri) {
+        throw new Error("Artifact fileData must have a fileUri.");
+      }
+      mimeType = artifact.fileData.mimeType;
     }
     const canonicalUri = await getCanonicalUri(
       this.rootDir,
@@ -102,6 +109,7 @@ class FileArtifactService {
     const metadata = {
       fileName: filename,
       mimeType,
+      fileUri,
       version: nextVersion,
       canonicalUri,
       customMetadata
@@ -153,6 +161,11 @@ class FileArtifactService {
       );
       const metadataPath = path.join(versionDir, "metadata.json");
       const metadata = await readMetadata(metadataPath);
+      if (metadata.fileUri) {
+        return {
+          fileData: { fileUri: metadata.fileUri, mimeType: metadata.mimeType }
+        };
+      }
       const storedFilename = path.basename(artifactDir);
       let contentPath = path.join(versionDir, storedFilename);
       if (metadata.canonicalUri) {

package/dist/cjs/artifacts/gcs_artifact_service.js

@@ -35,12 +35,16 @@ var import_logger = require("../utils/logger.js");
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const GCS_FILE_URI_METADATA_KEY = "adkFileUri";
+const GCS_FILE_MIME_TYPE_METADATA_KEY = "adkFileMimeType";
+const GCS_DISPLAY_NAME_METADATA_KEY = "adkDisplayName";
+const GCS_IS_TEXT_METADATA_KEY = "adkIsText";
 class GcsArtifactService {
-  constructor(bucket) {
-    this.bucket = new import_storage.Storage().bucket(bucket);
+  constructor(bucket, options) {
+    this.bucket = new import_storage.Storage(options).bucket(bucket);
   }
   async saveArtifact(request) {
-    if (!request.artifact.inlineData && !request.artifact.text) {
+    if (!request.artifact.inlineData && !request.artifact.text && !request.artifact.fileData) {
       throw new Error("Artifact must have either inlineData or text content.");
     }
     const versions = await this.listVersions(request);
@@ -51,24 +55,48 @@ class GcsArtifactService {
         version
       })
     );
-    const metadata = request.customMetadata || {};
+    const customMetadata = {
+      ...request.customMetadata
+    };
     if (request.artifact.inlineData) {
+      if (request.artifact.inlineData.displayName) {
+        customMetadata[GCS_DISPLAY_NAME_METADATA_KEY] = request.artifact.inlineData.displayName;
+      }
       await file.save(
         Buffer.from(request.artifact.inlineData.data || "", "base64"),
         {
           contentType: request.artifact.inlineData.mimeType,
-          metadata
+          metadata: { metadata: customMetadata }
         }
       );
       return version;
+    } else if (request.artifact.text !== void 0) {
+      await file.save(request.artifact.text, {
+        contentType: "text/plain",
+        metadata: {
+          metadata: { ...customMetadata, [GCS_IS_TEXT_METADATA_KEY]: "true" }
+        }
+      });
+      return version;
+    } else {
+      const fileData = request.artifact.fileData;
+      const fileUri = fileData == null ? void 0 : fileData.fileUri;
+      if (!fileUri) {
+        throw new Error("Artifact fileData must have a fileUri.");
+      }
+      customMetadata[GCS_FILE_URI_METADATA_KEY] = fileUri;
+      if (fileData.mimeType) {
+        customMetadata[GCS_FILE_MIME_TYPE_METADATA_KEY] = fileData.mimeType;
+      }
+      await file.save("", {
+        contentType: fileData.mimeType || void 0,
+        metadata: { metadata: customMetadata }
+      });
+      return version;
     }
-    await file.save(request.artifact.text, {
-      contentType: "text/plain",
-      metadata
-    });
-    return version;
   }
   async loadArtifact(request) {
+    var _a, _b, _c;
     try {
       let version = request.version;
       if (version === void 0) {
@@ -84,11 +112,25 @@ class GcsArtifactService {
           version
         })
       );
-      const [[metadata], [rawDataBuffer]] = await Promise.all([
-        file.getMetadata(),
-        file.download()
-      ]);
-      if (metadata.contentType === "text/plain") {
+      const [metadata] = await file.getMetadata();
+      const customMeta = (_a = metadata.metadata) != null ? _a : {};
+      const fileUri = customMeta[GCS_FILE_URI_METADATA_KEY];
+      if (fileUri) {
+        const mimeType = (_c = (_b = customMeta[GCS_FILE_MIME_TYPE_METADATA_KEY]) != null ? _b : metadata.contentType) != null ? _c : void 0;
+        return { fileData: { fileUri, mimeType } };
+      }
+      const [rawDataBuffer] = await file.download();
+      const displayName = customMeta[GCS_DISPLAY_NAME_METADATA_KEY];
+      if (displayName) {
+        return {
+          inlineData: {
+            data: rawDataBuffer.toString("base64"),
+            mimeType: metadata.contentType,
+            displayName
+          }
+        };
+      }
+      if (customMeta[GCS_IS_TEXT_METADATA_KEY] === "true" || metadata.contentType === "text/plain") {
         return (0, import_genai.createPartFromText)(rawDataBuffer.toString("utf-8"));
       }
       return (0, import_genai.createPartFromBase64)(

package/dist/cjs/artifacts/in_memory_artifact_service.js

@@ -28,6 +28,7 @@ __export(in_memory_artifact_service_exports, {
   isInMemoryConnectionString: () => isInMemoryConnectionString
 });
 module.exports = __toCommonJS(in_memory_artifact_service_exports);
+var import_logger = require("../utils/logger.js");
 /**
  * @license
  * Copyright 2025 Google LLC
@@ -48,7 +49,7 @@ class InMemoryArtifactService {
     artifact,
     customMetadata
   }) {
-    if (!artifact.inlineData && !artifact.text) {
+    if (!artifact.inlineData && !artifact.text && !artifact.fileData) {
       return Promise.reject(
         new Error("Artifact must have either inlineData or text content.")
       );
@@ -62,6 +63,10 @@ class InMemoryArtifactService {
       version,
       customMetadata
     };
+    if (!artifact.inlineData && artifact.text === void 0) {
+      const fileData = artifact.fileData;
+      metadata.mimeType = fileData.mimeType;
+    }
     this.artifacts[path].push({ part: artifact, metadata });
     return Promise.resolve(version);
   }
@@ -80,6 +85,12 @@ class InMemoryArtifactService {
     if (version === void 0) {
       version = versions.length - 1;
     }
+    if (!versions[version]) {
+      import_logger.logger.warn(
+        `[InMemoryArtifactService] loadArtifact: Artifact ${filename} version ${version} not found`
+      );
+      return Promise.resolve(void 0);
+    }
     return Promise.resolve(versions[version].part);
   }
   listArtifactKeys({

package/dist/cjs/artifacts/scoped_artifact_service.js

@@ -0,0 +1,101 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var scoped_artifact_service_exports = {};
+__export(scoped_artifact_service_exports, {
+  ScopedArtifactService: () => ScopedArtifactService
+});
+module.exports = __toCommonJS(scoped_artifact_service_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class ScopedArtifactService {
+  constructor(delegate, appName, userId, sessionId) {
+    this.delegate = delegate;
+    this.appName = appName;
+    this.userId = userId;
+    this.sessionId = sessionId;
+  }
+  async saveArtifact(request) {
+    return this.delegate.saveArtifact({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      ...request
+    });
+  }
+  async loadArtifact(request) {
+    return this.delegate.loadArtifact({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      ...request
+    });
+  }
+  async listArtifactKeys() {
+    return this.delegate.listArtifactKeys({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId
+    });
+  }
+  async deleteArtifact(filename) {
+    return this.delegate.deleteArtifact({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      filename
+    });
+  }
+  async listVersions(filename) {
+    return this.delegate.listVersions({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      filename
+    });
+  }
+  async listArtifactVersions(filename) {
+    return this.delegate.listArtifactVersions({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      filename
+    });
+  }
+  async getArtifactVersion(request) {
+    return this.delegate.getArtifactVersion({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      ...request
+    });
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ScopedArtifactService
+});

package/dist/cjs/artifacts/session_artifact_service.js

@@ -0,0 +1,27 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var session_artifact_service_exports = {};
+module.exports = __toCommonJS(session_artifact_service_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/dist/cjs/auth/oauth2/oauth2_discovery.js

@@ -26,7 +26,9 @@ var oauth2_discovery_exports = {};
 __export(oauth2_discovery_exports, {
   AuthorizationServerMetadataSchema: () => AuthorizationServerMetadataSchema,
   OAuth2DiscoveryManager: () => OAuth2DiscoveryManager,
-  ProtectedResourceMetadataSchema: () => ProtectedResourceMetadataSchema
+  ProtectedResourceMetadataSchema: () => ProtectedResourceMetadataSchema,
+  normaliseHostname: () => normaliseHostname,
+  validateDiscoveryUrl: () => validateDiscoveryUrl
 });
 module.exports = __toCommonJS(oauth2_discovery_exports);
 var import_zod = require("zod");
@@ -84,7 +86,11 @@ class OAuth2DiscoveryManager {
           method: "GET",
           headers: {
             Accept: "application/json"
-          }
+          },
+          // Never follow redirects: validateDiscoveryUrl only checks the
+          // initial URL, so following a 3xx would let a validated host
+          // redirect discovery to a private/cloud-metadata address (CWE-918).
+          redirect: "error"
         });
         if (!response.ok) {
           continue;
@@ -132,7 +138,11 @@ class OAuth2DiscoveryManager {
         method: "GET",
         headers: {
           Accept: "application/json"
-        }
+        },
+        // Never follow redirects: validateDiscoveryUrl only checks the
+        // initial URL, so following a 3xx would let a validated host
+        // redirect discovery to a private/cloud-metadata address (CWE-918).
+        redirect: "error"
       });
       if (!response.ok) {
         return void 0;
@@ -172,7 +182,7 @@ function validateDiscoveryUrl(urlStr) {
       return false;
     }
     const host = normaliseHostname(url.hostname.toLowerCase());
-    if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
+    if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "[::]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
       import_logger.logger.warn(`Unsafe host for discovery URL: ${host}`);
       return false;
     }
@@ -206,5 +216,7 @@ function validateDiscoveryUrl(urlStr) {
 0 && (module.exports = {
   AuthorizationServerMetadataSchema,
   OAuth2DiscoveryManager,
-  ProtectedResourceMetadataSchema
+  ProtectedResourceMetadataSchema,
+  normaliseHostname,
+  validateDiscoveryUrl
 });

package/dist/cjs/auth/oauth2/oauth2_utils.js

@@ -32,6 +32,7 @@ __export(oauth2_utils_exports, {
 });
 module.exports = __toCommonJS(oauth2_utils_exports);
 var import_logger = require("../../utils/logger.js");
+var import_oauth2_discovery = require("./oauth2_discovery.js");
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -51,13 +52,23 @@ function getTokenEndpoint(authScheme) {
   return void 0;
 }
 async function fetchOAuth2Tokens(endpoint, body) {
+  if (!(0, import_oauth2_discovery.validateDiscoveryUrl)(endpoint)) {
+    throw new Error(
+      `SSRF protection: OAuth2 token endpoint '${endpoint}' is not allowed. Must use HTTPS and must not target private/loopback/cloud-metadata addresses.`
+    );
+  }
   try {
     const response = await fetch(endpoint, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: body.toString()
+      body: body.toString(),
+      // Never follow redirects: the SSRF blocklist only validates `endpoint`,
+      // so a validated host that responds with a 3xx could otherwise redirect
+      // this credential-bearing POST (client_secret/refresh_token) to a
+      // private/cloud-metadata address (CWE-918).
+      redirect: "error"
     });
     if (!response.ok) {
       throw new Error(`Token request failed with status ${response.status}`);